View
4
Download
0
Category
Preview:
Citation preview
WHOAMI
• CHRISTOPHER KRAH
• : @0XRICKSANCHEZ
• : 0XRICKSANCHEZ
• : RICKSANCHEZ
• : CHRISTOPHER.KRAH@FKIE.FRAUNHOFER.DE
• B.SC - COMP. SCI. – 2017
• M.SC COMP. SCI. - 2019
• SECURITY RESEARCHER @ FRAUNHOFER FKIE IN GERMANY – 2019
• INTERESTS: UNIX, IOT, RE, EXPLOIT-DEV. & FUZZING
2
FUZZING
ck@hitb:~/why$
"Fuzzing renaissance"
Allows for deeply inspecting a project
Manual bug hunting not scalable
Fun
5@0xricksanchez
*BSD• NOT INTERESTED IN WINDOWS
• ALSO EVERYBODY DOES GNU/LINUX...
• NOT ALL SYSTEMS TESTED EQUALLY WELL
• SO WHY NOT CHECK OUT THE BSDS!
ck@hitb:~/why$
6@0xricksanchez
FILE SYSTEMS!
ck@hitb:~/why$
Userland UFS VFSNo
Yes
UFS EXT ZFS ...
Caching
Device driver
Disks
Syscall interface
Kernel land
8@0xricksanchez
FILE SYSTEMS!
ck@hitb:~/why$
Userland UFS VFSNo
Yes
UFS EXT ZFS ...
Caching
Device driver
Disks
Syscall interface
Kernel land
9@0xricksanchez
SO WHY FILESYSTEMS AFTERALL?
ck@hitb:~/why$
• FILESYSTEMS OFTEN OVERLOOKED
• HOWEVER:
• AT LEAST AVAILABLITY OF DATA SHOULD BE ENSURED/TESTED FOR
• ADDITIONALLY: DAILY USAGE OF E.G. USB DRIVES
• ULTIMATELY, FILESYSTEMS == KERNEL CODE EXECUTION
10Availability@0xricksanchez
WHY NOT USE 'X' FOR KERNEL FUZZING?
ck@hitb:~/why$
• INTERESTED IN THE COMPLETE EXECUTION CHAIN
• METADATA PARSING
• MOUNTING
• ACCESSING
• MODIFCATION
• UNMOUNTING
11@0xricksanchez
1. TEST CASE GENERATOR
ck@hitb:~/how$
• WHAT'S A VALID TEST CASE WHEN LOOKING FOR FILE SYSTEMS BUGS?
• AN ACTUAL DISK IMAGE!
• AUTOMATIC GENERATION OF
• (NON-) POPULATED FS WITH VARIABLE SIZES
• CURRENTLY SUPPORTED: UFSV1/V2, ZFS, EXT2/3/4, APFS
• OBSERVATION: AVOID HEADACHES BY USING THE SAME OS FOR TARGET AND HOST..
13@0xricksanchez
Read config
Generate
2. MU߹Aไ1ON�
ck@hitb:~/how$
• ZERO-/FF-OUT/RANDOMIZE SUPERBLOCKS, CYLINDER GROUPS, SINGLE BYTES
• TARGETED MUTATIONS IN SUPERBLOCK(S)
• (DETERMINISTIC) FULL BINARY MUTATION VIA RADAMSA
• OBSERVATION: 'DUMB MUTATIONS' OFTEN ENOUGH*
14
Fetch test case Read config Apply mutation Save sample
@0xricksanchez
2. MU߹Aไ1ON�
ck@hitb:~/how$
FS #good_mounts #bad_mounts
UFS ~ 20% ~ 80%
EXT ~ 80% ~ 20%
ZFS ~ 7.5% ~ 92.5%
15
Scenario Result
Pool not recognized Not importable
Pool metadata corrupted Not importable
One or more devices contain corrupted data Not importable
Valid pool Importable
@0xricksanchez
2. MU߹Aไ1ON�
ck@hitb:~/how$
FS #good_mounts #bad_mounts
UFS ~ 20% ~ 80%
EXT ~ 80% ~ 20%
ZFS ~ 7.5% ~ 92.5%
16
• OBSERVATION: INVERSE CORRELATION BETWEEN UFS AND EXT
• OBSERVATION: INTEGRITY CHECKS OF ZFS
@0xricksanchez
3. USER EMULATION
ck@hitb:~/how$
Mount
Alive? Restart VMNo
Yes
i = 0
Alive?No
Roll argument(s)
Run it
i += 1
Select next command
Yes
Yes
i <= len(cmds)
NoTeardown
18@0xricksanchez
3. USER EMULATION
ck@hitb:~/how$
• STATIC VS. RANDOMIZED ORDER
• STATIC VS. RANDOMIZED ARGUMENTS
Category Operation
changing geometry chflags, chgrp, chmod, chown, mv, rm, truncate*
extending geometry cp, dd, echo, ln, mkdir, mknod, split*, touch
parsing geometry basename*, chdir, dirname*, du*, file, find, getfacl*,
ls, readlink, stat, wc*
19@0xricksanchez
3. USER EMULATION
ck@hitb:~/how$
• OBSERVATION: RNG MATTERS!
• OBSERVATION: CRASHES HAPPEN DURING MOUNT, USER-EMUL. & TEARDOWN!
FS Static User-Emulation Random User-Emulation
#good #bad #good #bad
UFS ~ 27.5% ~ 72.5% ~ 45% ~ 55%
EXT ~ 20% ~ 80% ~ 40% ~ 60%
ZFS ~ 98 % ~ 2% ~ 98 % ~ 2%
20@0xricksanchez
4. MONITORING
ck@hitb:~/how$
Permanent alive checks for
fuzzers
Tracking of samples,
mutations, seeds, crashes
Logging of FS structure
Logging of user emulation
21@0xricksanchez
5. VERIFICATION
ck@hitb:~/how$
• AUTOMATIC CONTINUOUS CHECKS FOR NEW CRASHES
• BASED ON HASH IDENTIFIER
• REPLAY ON SEPARATE, 'ALWAYS FRESH' INSTANCE
• OBSERVATION : OS SIDE EFFECTS NOT AS BAD AS EXPECTED
22
New crash? wait
No
Unique?No
Yes
Yes
Fetch logs
Replay@0xricksanchez
PUTTING THINGS TOGETHER
ck@hitb:~/how$
23
Fetch test case
Read config
Apply mutation
Save sample
Generate test case
Mount
Alive
?Restart VM
No
Yes
i = 0
Alive
?
No
Transfer
Save logs
Yes
i <=
len(cmds)
NoTeardown
Select next command
Yes
Run it
i += 1
Roll argument(s)
Start
New
crash
?
waitNo
Unique?
No
Yes
Yes
Fetch logs
Replay
Save result
Reset VM
FINDINGS
ck@hitb:~/results$
• >100 UNIQUE CRASHES IN UFS/EXT
• MULTIPLE OOB-R/OOB-W
• TRIPLE FAULT IN UFS
• DOUBLE FAULT IN EXT
• BONUS: NON-DETERMINISTIC CRASH IN UFS WITH 6 UNIQUE CORE DUMPS SO FAR
• OVERALL >82% REPRODUCIBILITY RATE
• ADDITIONALLY ANOTHER 5% PRODUCED A DIFFERENT CRASH ON VERIFICATION
• 17 SYSCALLS COVERED
26@0xricksanchez
SYSCALLS
• 26 USERLAND PROGRAMS sys_unmount sys_linkat sys_rmdir sys_open_rwtc
sys_symlink sys_access sys_openat_rwtc sys_rename
sys_mknodat sys_unlink sys_write sys_mkdir
sys_nmount sys_fstatat sys_writev sys_read
sys_ftruncate
@0xricksanchez 27
ck@hitb:~/results$
Category Operation
changing geometry chflags, chgrp, chmod, chown, mv, rm, truncate*
extending geometry cp, dd, echo, ln, mkdir, mknod, split*, touch
parsing geometry basename*, chdir, dirname*, du*, file, find, getfacl*,
ls, readlink, stat, wc*
• 17 SYSTEM CALLS
• 2 NEW VIA RANDOMIZING
• 3 NEW VIA EXTENDED EMULATION
SYSCALLS
sys_unmount sys_linkat sys_rmdir sys_open_rwtc
sys_symlink sys_access sys_openat_rwtc sys_rename
sys_mknodat sys_unlink sys_write sys_mkdir
sys_nmount sys_fstatat sys_writev sys_read
sys_ftruncate
@0xricksanchez 28
ck@hitb:~/results$
• 17 SYSTEM CALLS
• 2 NEW VIA RANDOMIZING
• 3 NEW VIA EXTENDED EMULATION
• OBSERVATION: RNG MATTERS!
• OBSERVATION: FINE TUNING MATTERS!
RESP.DISCLOSURE - FREEBSD
ck@hitb:~/results$
• ~50/>100 DISCLOSED VIA RESPONSIBLE DISCLOSURE
• A BUNCH OF MAILS LATER:
• 21 CONFIRMED BUG TRACKER NUMBERS
• 10 CONFIRMED FIXES
• HOWEVER, NO FEEDBACK/REPLIES FOR MONTHS NOW..
29@0xricksanchez
RESP.DISCLOSURE - NET-/OPENBSD
ck@hitb:~/results$
• SHORT EVALUATION IN BOTH OF THESE SHOW SIMILAR RESULTS (FFS/UFS).
• NETBSD: "NOT INTERESTED"
• #FIXES: 0
• OPENBSD: "FFS/UFS FILESYSTEM HAS MADE THESE DESIGN DECISIONS, KERNEL HAS NO LOGIC TO
HANDLE INCONSISTENCIES, …"
• #FIXES: 0
30@0xricksanchez
BOOT TIMES
ck@hitb:~/caveats$
-> % CAT RESULT.TXT
| FAT | FAT_DIAG | SMALL_DIAG | SMALL_DIAG_BOOT_DELAY |
---------|----------|----------------------|---------------------|----------------------------------|
RUN 1:| 39.23S | 41.97S (+7.0%) | 37.79S (-10.0%)| 26.10S (-38.2%) |
RUN 2:| 39.77S | 40.80S (+2.6%) | 36.24S (-12.1%)| 27.68S (-32.2%) |
RUN 3:| 38.15S | 40.79S (+6.9%) | 37.26S (-8.7%) | 27.11S (-34.5%) |
RUN 4:| 39.12S | 38.82S (-0.1%) | 36.73S (-5.4%) | 26.01S (-33.0%) |
RUN 5:| 39.76S | 41.45S (+4.3%) | 36.71S (-11.5%)| 25.58S (-38.3%) |
==== |======|============|============|==================|
AVG:| 39.21S | 40.77S (+4%) | 36.95S (-9.4%) | 26,50S (-35.0%) |
32@0xricksanchez
BOOT TIMES MAN NETDUMP
ck@hitb:~/caveats$
• NETDUMP - PROTOCOL FOR TRANSMITTING KERNEL DUMPS TO A REMOTE SERVER
• WOULD ELIMINATE NEED TO REBOOT TO FETCH CORE DETAILS
• HOWEVER: UNRELIABLE IN MY SETUP
33
Transfer
@0xricksanchez
BOOT TIMES LIBOS
ck@hitb:~/caveats$
• INSTEAD OF FULL FLETCHED KVM VM WITH 'OPTIMIZED' KERNEL
• ONLY PLUG NECESSARY PARTS TOGETHER...
34@0xricksanchez
SMART(ER) MU߹Aไ1ON�
ck@hitb:~/caveats$
• RIGHT NOW:
• NO RESTORING OR RE-CALCULATION OF CHECKSUMS/INTEGRITY CHECKS
• IMPORTANT FOR EXT4, ZFS
• KERNEL FEEDBACK, KASAN
• AUTOMATIC DEDUCTION OF METADATA FIELD TYPES/SIZE
35@0xricksanchez
SCALABILITY?
ck@hitb:~/caveats$
36@0xricksanchez
Fully-fledged
VM instance for
each fuzzer
Manual config adjustments
KVM allows for easy
automatic cloning
CONCLUSION
ck@hitb:~/EOF$
• WRITE YOUR OWN FUZZING TOOLS!
• KERNELS STILL OFFER LOTS OF BUGS THAT WAIT TO BE UNCOVERED
• MODERN FS IMPLEMENTATIONS WILL NEED SOME MORE CONSIDERATIONS
• RESPONSIBLE DISCLOSURE SOMETIMES FRUSTRATING
• FILE SYSTEMS ALLOW FOR DEEP INTROSPECTION OF USERLAND TO KERNEL LAND BEHAVIOR
38@0xricksanchez
FIN.
ck@hitb:~/EOF$
• QUESTIONS/SUGGESSTIONS? PLEASE REACH OUT!
• : HTTPS://TWITTER.COM/0XRICKSANCHEZ
• : HTTPS://GITHUB.COM/0XRICKSANCHEZ
• : HTTPS://0X00SEC.ORG/U/RICKSANCHEZ
• : CHRISTOPHER.KRAH@FKIE.FRAUNHOFER.DE
• SLIDES/SCRIPTS?
• WILL BE HERE: HTTPS://GITHUB.COM/0XRICKSANCHEZ/FS-FUZZER
39@0xricksanchez
Recommended